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Remarks/Arguments 



Claims 1-22 are pending and of these, claims 1-8, 11-18, 21 and 22 stand rejected on 
varying grounds under §1 02(e). Claims 9-10 are allowed and claims 19-20 are deemed to recite 
allowable subject matter. 

Claim 1 has been canceled and claims 2-8 have been amended to depend from allowed 
claim 9 and otherwise resolve various informalities that result from the new dependency. Claim 
11 has been amended to include the allowable features from claim 19 and claim 19 has been 
canceled. Claims 12-14 and 18 have been amended to resolve various informalities and claim 
20 has been amended to depend from claim 11. Claims 21-22 have been rewritten in 
independent form. 

In view of the comments below, Applicant respectfully requests that the Examiner 
withdraw the Finality of May 26, 2006 Office action, enter the proposed amendments, reconsider 
the present application including claims 2 - 8, 11 - 18, 20 -21, and 22 and withdraw the 
respective rejection of or objection to these claims. 

a) As an initial matter, Applicant submits that the Finality of the May 26, 2006 Office action 
is premature and respectfully requests that the Examiner reopen prosecution on the merits. More 
specifically, claims 21-22 were added in the March 6, 2006 Amendment and response. The 
Examiner has indicated in summary fashion that claims 21-22 are rejected. However, the 
Examiner has not provided any reasoning or rational or indication of how the cited reference 
(Ando et al) was applied to arrive at this rejection and thus Applicant is not able to evaluate the 
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merits of the rejection, The May 26, 2006 Office action was considered to be a Final Office 
Action by the Examiner. Applicant respectfully submits that this is a premature Final since all 
pending claims have not been examined by the Examiner or, if so, the results of this 
consideration have not been communicated to the Applicant. Applicant's representative spoke 
briefly by Telephone with Examiner Parthasarathy on or about June 14, 2006 and it is believed 
that the Examiner agrees with the Applicant Thus Applicant respectfully requests that the 
Finality of the May 26, 2006 Office action be withdrawn and that prosecution on the merits be re- 
opened. 

a) Claims 1-8, 1 1-18 and 21-22 stand rejected under 35 U.S.C. 102(e) as being anticipated 
by Ando et al (U.S. Patent No. 6,895,432). 

Re: Claims 1 - 8: 

Claim 1 has been canceled and thus the rejection of this claim is moot Claim 2-8 have 
been amended to depend from allowed claim 9 and thus, Applicant respectfully submits that 
claims 2 — 8 are presently allowable and thus requests that the Examiner reconsider and withdraw 
the rejection of claims 2-8 under 35 U.S.C. 102(e) as being anticipated by Ando et al (U.S. 
Patent No. 6,895,432). 

Re: Claims 11-20: 

Claim 1 1 has been amended to recite the features of previous claim 19 (which has been 
cancelled). As noted by the Examiner, original claim 1 9 (depending from claim 11) recited 
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allowable subject matter and amended claim 1 1 includes all features of previous claim 1 1 and 
claim 19. Therefore, Applicant respectfully submits that amended claim 1 1 as well as claims 
depending there from, specifically dependent claims 12 — 18 and claim 20 as amended are in 
condition for allowance and thus requests that the Examiner reconsider and withdraw the 
rejection of claims 1 1-1 8 and 20 under 35 U.S.C. 102(e) as being anticipated by Ando et al (U.S. 
Patent No. 6,895,432). 

Re: claims 21-22: 

Claims 2 1 and 22 have been rewritten in independent form to include all limitations of 
the respective previous claim 21 and 22 and corresponding base claim 1 and 1 1 . The Examiner 
as noted above did not provide any specific rational for rejecting claims 21-22 based on Ando et 
aL 

Applicant has reviewed these claims in view of Ando et al as well as the Examiner's 
comments regarding various other claims and from this it seems clear that the features of claim 
21 and 22 are not shown or suggested by Ando et al. and thus claims 21-22 should be allowable 
over this reference . 

The Ando et al reference describes a technique for causing routers to discard 

unauthorized data packets (abstract, etc). Ando et al shows a victim host computer 30 

(destination device) receives an unauthorized packet (col. 5, lines 40-44, quoted below). 

"The unauthorized access packet having reached the border router 10 passes 
through an IP packet routing unit 100 within the border router 10, and is thereafter 
received by an IP packet forwarding /receiving unit 300 of the host computer (victim) 30 
via the relay router20. 5> 
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The victim host computer 30 (destination device) determines that the unauthorized packet 
may be harmful (coL 5, lines 45-59, quoted below). 

The unauthorized access packet is further transferred to an unauthorized intrusion 
monitoring unit 340 through an application protocol (which will hereinafter simply be 
referred to as an application) of a TCP/IP (Transmission Control Protocol over Internet 
Protocol) layer (Operation step OP1). 

Next, the unauthorized intrusion monitoring unit 340 refers to threshold value data 
350 and, if over a predetermined threshold value, notifies the IP packet 
forwarding/receiving unit 300 of unauthorized access occurrence data (which is search 
request data that will be explained in depth later on) indicating that the unauthorized 
access occurs. An administrator of the host computer 30 presets the threshold value data 
350," 

The victim host computer 30 (forwarding/receiving unit 300) then sends corresponding 
information (unauthorized access occurrence data - col. 5, lines 60-65, quoted below) to border 
router 10. 

"The unauthorized access occurrence data transmitted from the IP packet 
forwarding/receiving unit 300 is inputted to a port 106 of the border router 10 via the relay 
router 20, and an unauthorized intrusion monitor 180 is notified of this item of 
unauthorized access occurrence data. Note that the unauthorized intrusion monitor 1 80 is 
notified of the unauthorized access occurrence data via precisely via the IP packet routing 
unit 100 from the port 106 (OP2)." 

The router 10 registers or stores unauthorized access information based on the 
unauthorized access occurrence data received from the victim host computer 30 (destination 
device) (coL 6, lines 1-6, quoted below). 

'The unauthorized intrusion monitor 180 registers an unauthorized access 
information table 150 with unauthorized access information based on the unauthorized 
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access occurrence data received (OP3). Further, the unauthorized intrusion monitor 1 80 
refers to border router information 152 and determines an information distributed 
destination (OP4), w 

The router 10 also, responsive to receiving the unauthorized access occurrence data, 
notifies other routers RT1 40 in other systems AS0O, AS01 of the unauthorized access 
information (col. 6, lines 7-12, quoted below). 

'The order router 10 notifies other routers RT1, 40 in the self autonomous 
system AS00 and other autonomous system AS01 adjacent thereto. Of a content of the 
unauthorized access information table 150, and requests the routers RT1 , 40 to register 
the same content in the unauthorized access information table in each order router 
(OP5)." 

Thereafter in the event of a re-intrusion (another unauthorized packet), the packet is 
compared to unauthorized access information corresponding to the unauthorized access 
occurrence data from the victim host computer 30 and the packet is discarded when the packet 
and information are coincident (col. 6, lines 13-23, quoted below). 

Thereafter, if the illegal party host computer 60 in the autonomous system 
AS01 makes a re- intrusion, the unauthorized access packet enters the IP packet routing 
unit 1 00 via port 107 (OP6). The IP packet routing unit 1 00 refers to the unauthorized 
access information table 150, and compares its content with a content of the 
unauthorized access packet received (OP7). 

As a result of the comparison, if these contents are coincident, the IP packet 
routing unit 100 discards the unauthorized access packet and shuts off the unauthorized 
access (OP8)." 
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Claim 21 and claim 22 (in analogous form) affirmatively recite "interrupting transmission 
of the data packet in response to determining that the data packet is potentially harmful to the 
destination device, the interrupting further comprising the step of communicating (emphasis 
added) with a second router to cause the second router to interrupt transmission of a future data 
packet". While Ando et al shows communicating from one router to another pursuant to 
interrupting transmission of a future data packet; Ando et al does not show performing such 
communicating responsive to determining that the data packet is potentially harmful as 
specifically claimed. Rather Ando et al as noted above, performs such communicating 
responsive to a destination device (victim computer 30) providing information concerning 
unauthorized access. 

Thus, Ando et al in view of the passages quoted above and passages cited by the 
Examiner or the balance of the reference clearly does not show or suggest all features 
(communicating with another router responsive to determining in the router . . .) of claim 21 or 
claim 22 and hence, does not support a § 1 02(e) rejection of these claims. 

Even assuming arguendo that Ando et al could be construed to show the interrupting 
process further comprising communicating with a second router to cause the second router to 
interrupt transmission of a future data packet all as claimed, Ando et al clearly relies on 
information corresponding to that provided by the destination device (victim host computer 30) 
(see again the passages quoted above and specifically col. 5, lines 60-65). 

Claim 21 and 22 further define the claimed determining in the router feature as 
determining in the router, without relying on information originated by the destination device, 
whether the data packet is potentially harmful to' the destination device. As noted above (quoted 
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passages page 13-14) in the analysis of Ando et al. any determination in a router is performed 
based on information provided by the destination device (victim host computer 30). Thus, claims 
21-22 clearly recite a feature that is not shown or suggested by Ando et al. and therefore in view 
of this additional reason are clearly allowable. 



requests that the Examiner reconsider and withdraw the rejection of claims 21-22 under 35 
U.S.C. 102(e) as being anticipated by Ando (U.S, Patent No. 6,895,432). 

Accordingly, Applicant respectfully submits that the claims, as amended, clearly and 
patentably distinguish over the cited references of record and as such are to be deemed allowable. 
Such allowance is hereby earnestly and respectfully solicited at an early date. If the Examiner 
has any suggestions or comments or questions, calls are welcomed at the phone number below. 

Although it is not anticipated that any fees are due or payable other than the extra claims 
fee separately considered given that this Amendment and Response is being timely filed with the 
3 months allotted, the Commissioner is hereby authorized to charge any fees that may be required 
to Deposit Account No. 50-3435. 



Therefore and in view of at least one or more of these reasons, Applicant respectfully 




Respectfully submitted, 



Ends. 

Law Office of Charles W. Bethards, LLP 
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